Description
end_pattern (called from internal_fnmatch) in the GNU C Library (aka glibc or libc6) before 2.22 might allow context-dependent attackers to cause a denial of service (application crash), as demonstrated by use of the fnmatch library function with the **(!() pattern. NOTE: this is not the same as CVE-2015-8984; also, some Linux distributions have fixed CVE-2015-8984 but have not fixed this additional fnmatch issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glibc | 2.22-1 | — |
| Debian 13 | glibc | 2.22-1 | — |
| Debian 12 | glibc | 2.22-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | glibc | 2.27-3ubuntu1.6+esm2 | USN-6762-1 |
| Ubuntu Pro 16.04 LTS | glibc | 2.23-0ubuntu11.3+esm6 | USN-6762-1 |
| Ubuntu Pro 14.04 LTS | eglibc | 2.19-0ubuntu6.15+esm3 | USN-6762-1 |
Advisories 1
- USN-6762-1 eglibc, glibc vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026